How to Run an Antivirus Scan on Mac
To run an antivirus scan on a Mac, start by choosing a scanner—either a reputable third‑party app or your organization’s enterprise tool if provided. macOS includes built‑in protections such as XProtect, Gatekeeper, and Notarization that reduce malware risk, but they are not a full‑featured antivirus product. If you suspect infection, run a scan with your chosen security app, review detected items, and follow the tool’s remediation steps. On this page you will find a practical, fact‑first walkthrough of how to run an antivirus scan on Mac, plus context on when and why scanning is appropriate.
When You Actually Need a Mac Antivirus Scan
A full antivirus scan on Mac is most often useful in specific situations rather than as routine weekly maintenance. Consider running a scan if you notice unusual behaviors (excessive ads, unexpected redirects), unfamiliar apps appearing in Launchpad or Activity Monitor, a sudden browser homepage change, or passwords that don’t work in legitimate sites. Scans are also recommended after installing pirated software, opening unexpected attachments, or connecting to unfamiliar networks. If your Mac is managed by an organization, follow your IT department’s guidance rather than installing unapproved tools.
Built‑in macOS Protections to Know
macOS provides several background defenses that lower risk without a third‑party antivirus:
- XProtect: Apple’s antimalware technology that checks files against known malware signatures.
- Gatekeeper: Requires developer identification for apps to run, unless you allow apps from anywhere in System Settings.
- Notarization: Apple‑reviewed apps from outside the App Store can be scanned and notarized before distribution.
- Runtime Protections and Malware Removal Tool: Periodically remove known Mac threats and block known malicious websites.
These protections help prevent malware from running, but they do not replace on‑demand scanning and removal tools for certain threats.
XProtect and Notarization in Practice
XProtect runs quietly and updates silently via Apple security updates, while notarization checks occur at install time when you open downloaded apps. Neither provides a user interface for scanning your entire system or quarantining files. Instead, they’re part of a layered defense: they stop known bad files early but still allow malware to arrive via social engineering or legitimate‑appearing installers that bypass checks. Third‑party antivirus apps add scheduled scans, on‑access monitoring, and broader detection capabilities.
How to Run an Antivirus Scan Using Built‑in Apple Controls
While macOS does not include an on‑demand scanner with a graphical “Scan now” button, you can check several built‑in areas and trigger system security operations:
Check Security & Privacy Settings
Go to System Settings > Privacy & Security (or Security & Privacy on older macOS). Review the General and Privacy tabs for blocked apps and to ensure App Downloads are set to a restrictive option such as App Store and identified developers unless you need broader sources. Any blocked app can be allowed individually, but only do so if you trust the app.
Update macOS and Installed Software
Open System Settings > General > Software Update and install any pending updates. Apple releases security updates regularly; keeping your system current is one of the most effective ways to reduce risk. Also update browsers, plugins, and third‑party apps to their latest versions to avoid exploit paths.
Run the Malware Removal Tool (Manual, Terminal)
Apple’s Malware Removal Tool can remove known macOS threats. To run it, update your Mac to the latest macOS version, then restart. On restart, the tool runs automatically before login. There is no progress indicator, and results are logged. You can also force a check by opening Terminal and running the command sudo /usr/libexec/remove_malware, then entering your admin password when prompted. Note that this tool is not a full antivirus and does not scan for adware, potentially unwanted programs (PUPs), or emerging threats.
How to Run a Third‑Party Antivirus Scan on Mac
Third‑party antivirus tools provide on‑access protection and on‑demand scanning for Mac. The general workflow is: install the app, ensure definitions are up to date, run a chosen scan type, review findings, and apply recommended actions such as quarantine or removal.
Install and Set Up a Reputable Antivirus App
Choose a well‑known security vendor that explicitly supports current macOS versions. Create or sign in to your account, install the app, and sign in if required. After the initial install, allow any recommended system extensions or MDM profiles the app requests so it can monitor system activity.
Update Virus Definitions
Before scanning, make sure the app’s detection engine and malware definitions are up to date. Most tools update automatically, but you can usually trigger a manual update from within the app’s dashboard or settings.
Choose a Scan Type and Start
Common scan options include Quick Scan (recent files and critical areas), Custom Scan (selected folders), and Full System Scan (entire disk). A quick scan is suitable for routine checks; a custom scan is useful when you suspect a specific download; a full scan is thorough but slower. Start the scan and avoid heavy disk usage during the process to prevent conflicts.
Review and Remediate Findings
When the scan finishes, review the list of detected items. Actions may include quarantine, removal, or ignoring. Follow the app’s guidance and check vendor documentation for each detected item. If a threat is found and removed, restart if recommended, then re‑scan to confirm the issue is resolved. Export or save the report for records, especially if you need to share it with IT support.
Understanding Scan Results and Common Findings
Antivirus results typically include detection names, file paths, and severity indicators. Common findings include adware, browser helper objects, suspicious utilities, and low‑risk potentially unwanted programs (PUPs). Not every detection is critical: some are minor toolbars or optimizers that you may have installed intentionally. Still, unknown or high‑risk detections should be quarantined or removed. If the scanner cannot remove a threat, note the name and file path and consult your security vendor or IT help desk for next steps.
Interpreting Detection Names
Detection names often include the vendor, threat family, and category. For example, OSAdware–IdentifyTool indicates adware; OSX/Genind or variants may indicate potentially unwanted components; and Trojan or Backdoor detections are serious and usually require removal. If you’re unsure about a detection, search the exact name with the vendor’s knowledge base or contact support before taking aggressive actions like deleting files manually.
Best Practices to Reduce Risk on Mac
Relying solely on a one‑time scan is less effective than maintaining good ongoing habits. Follow these evidence‑based practices to lower risk on macOS:
- Keep macOS and all apps up to date.
- Only install apps from the App Store or from identified developers when possible.
- Be cautious with email attachments, pirated software, and links from unknown sources.
- Use strong, unique passwords and enable account passwords and login protections.
- Limit browser extensions and remove unused plugins.
- Back up important data to an external drive or encrypted cloud service.
Comparing Scan Options: Built‑In vs Third‑Party
| Feature | macOS Built‑In | Third‑Party Antivirus |
|---|---|---|
| On‑demand scanning | Limited; no full system GUI scan | Quick, custom, and full scans with UI |
| On‑access (real‑time) protection | Basic (XProtect, Gatekeeper, notarization) | Yes; monitors files, downloads, and browser activity |
| Malware definitions updates | Apple security updates | Automatic or manual updates from vendor |
| Removal tools for known macOS threats | Apple’s Malware Removal Tool (automatic) | Often includes removal and quarantine |
| Adware/PUP detection | Not provided | Commonly included |
| Management and reporting | None for user‑initiated scans | Dashboards, logs, and export options |
What to Do If You Find a Persistent Threat
If a scan detects a stubborn or unfamiliar threat, disconnect from shared networks to limit spread, back up critical data, and consult your security vendor’s support or your organization’s IT help desk. Follow their instructions for removal or escalation. Change passwords if you suspect credentials were exposed, and re‑scan after remediation to confirm the system is clean.
Final Recommendations
For most everyday Mac users, enabling built‑in protections and practicing careful app installation and browsing habits significantly reduce risk. If you need deeper visibility or remediation, choose a reputable third‑party antivirus that supports your macOS version, keep it updated, and run regular scans per the vendor’s guidance. Periodically review results, keep backups, and stay cautious with downloads and attachments to maintain a secure Mac environment.
When in doubt about a detection or persistent issue, seek advice from your security product support or your IT department rather than attempting manual file removal.
This guide reflects common capabilities as of 2026 and applies to recent macOS versions. Product features and vendor offerings change; confirm details with your specific security app and macOS version.